Enable machine to machine authentication in oauth - oauth-2.0

Question

I currently run a frontend with a backend api pool in my kubernetes. Both services are secured via an auth2-proxy.
As for the frontend, the auth-workflow is done by users entering their credentials and every frontend - backend communication is secured, therefore.
Additionally, an automated service (CI/CD) must also connect to the API. I have read that oauth can also handle basic auth client username/secret authentication but I cannot get the flow to work. I have the credentials of my SSO provider and retrieve the access_token like this:
curl --header 'Content-Type: application/x-www-form-urlencoded' --header 'Authorization: Basic user:secret(base64encoded)' --request POST https://sso.provider.com/as/token.oauth2\?'grant_type=client_credentials'
With my setup like:
api-ingress.yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: sd-ingress
annotations:
# nginx.ingress.kubernetes.io/auth-signin: https://example.net/oauth2/start?rd=$scheme://$host$escaped_request_uri
nginx.ingress.kubernetes.io/auth-url: https://example.net/oauth2/auth
nginx.ingress.kubernetes.io/proxy-send-timeout: "1800"
nginx.ingress.kubernetes.io/proxy-read-timeout: "1800"
nginx.ingress.kubernetes.io/affinity: "cookie"
nginx.ingress.kubernetes.io/affinity-mode: "persistent"
nginx.ingress.kubernetes.io/ssl-redirect: "true"
nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
nginx.ingress.kubernetes.io/use-forwarded-headers: "false"
kubernetes.io/ingress.allow-http: "false"
nginx.ingress.kubernetes.io/rewrite-target: /$2
spec:
ingressClassName: nginx
tls:
- hosts:
- example.com
rules:
- host: example.com
http:
paths:
- path: /api(/|$)(.*)
pathType: Prefix
backend:
service:
name: sd-svc
port:
number: 8080
oauth2-config.yaml (excerpt)
...
args:
- --skip-jwt-bearer-tokens=true
- --show-debug-on-error=true
- --http-address=0.0.0.0:4180
- --provider=oidc
- --oidc-issuer-url=https://sso.provider.com
- --metrics-address=0.0.0.0:44180
- --acr-values=gas:strong
- --cookie-domain=example.net
- --oidc-email-claim=sub
- --whitelist-domain=.example.net
- --config=/etc/oauth2_proxy/oauth2_proxy.cfg
env:
- name: OAUTH2_PROXY_CLIENT_ID
valueFrom:
secretKeyRef:
name: oauth2-secret
key: client-id
- name: OAUTH2_PROXY_CLIENT_SECRET
valueFrom:
secretKeyRef:
name: oauth2-secret
key: client-secret
- name: OAUTH2_PROXY_COOKIE_SECRET
valueFrom:
secretKeyRef:
name: oauth2-secret
key: cookie-secret
...
It does not work once curl-ing the api:
curl --location --request GET 'https://example.net/api/get_queue' --header 'Authorization: Bearer <Token>' --header 'Content-Type: application/json; charset=utf-8'
The oauth logs:
[2022/10/25 11:32:03] [jwt_session.go:51] Error retrieving session from token in Authorization header: no valid bearer token found in authorization header
-- Version used: oauth2-proxy:v7.3.0